SK-CERT CyberGame 2026: Malware Analysis & Reverse Engineering Writeup
A complete walkthrough of the SK-CERT CyberGame 2026 malware analysis and reverse engineering challenges. The Real World challenge dissects a live ransomware decryptor - a self-extracting ELF wrapper around a modified ChaCha20 cipher with custom constants, arithmetic right shifts, and nine double-rounds - requiring RSA private key extraction and manual double-layer decryption. Lesser Less reverse engineers a trojanized ELF pager binary that hides a shell command by matching 2-byte SHA-256 hashes, solved via a 65,536-entry brute-force lookup table. Lock Screen analyzes an Android APK using JADX, discovers a header-dependent XOR keystream on a remote /init endpoint, and extends input length to dump the full repeating flag. Flappy dissects a Rust-compiled WebAssembly credential exfiltration module disguised as a Flappy Bird game, recovering the XOR key via a two-pass known-plaintext attack.
May 13, 2026